cPanel Patches EmailTrack Flaw That Could Let Hosting Accounts Gain Root Access
Summary
CVE-2026-67401 affects supported cPanel and WHM versions. An authenticated account with mail-related privileges could use EmailTrack to create files and potentially run code as root. Fixed builds are available; no public exploit or exploitation report was found.
Key points
- cPanel describes CVE-2026-67401 as an SQL injection flaw in EmailTrack affecting all supported cPanel and WHM versions.
- An authenticated hosting account with mail-related privileges could create files on the server, potentially leading to root-level code execution.
- Fixed builds are available for release lines 11.110, 11.134, 11.136, 11.138, and WP Squared.
- The advisory does not explain how the SQL injection leads to file creation and root access, or provide interim mitigation for servers that cannot be updated.
- The report found no public exploit code or exploitation reports as of September 9; the CVE was not listed in the CISA Known Exploited Vulnerabilities catalog version released September 8. These checks do not rule out exploitation.
Article Details
- Vulnerability Types
- SQL injection
- Arbitrary file creation
- Privilege escalation
- Affected Versions
- cPanel and WHM (all supported versions)
- Exploitation Status
- not_reported
- Exploit Availability
- none_reported
- Patch Status
- available
MITRE ATT&CK
CVE
People
Vendors
Products
cPanelcPanel has patched CVE-2026-67401, a flaw in EmailTrack that could let an authenticated hosting account create files and potentially escalate to root on the entire server.EmailTrackcPanel has patched CVE-2026-67401, a flaw in EmailTrack that could let an authenticated hosting account create files and potentially escalate to root on the entire server.WHMThe issue affects all supported cPanel and WHM versions, with fixed builds now available across the 11.110, 11.134, 11.136, 11.138, and WP Squared release lines.